Mastering Kali Linux for Advanced Penetration Testing - Fourth Edition

2

Open-Source Intelligence and Passive Reconnaissance

Gathering all possible information on a target is always the most important aspect of a penetration tester’s thinking to achieve the best outcomes. In cybersecurity, gathering information through publicly available sources is often referred to as Open-Source Intelligence (OSINT). Passive reconnaissance through OSINT occurs during the first step of the kill chain when conducting a penetration test or attack against a given organization. An attacker will typically dedicate up to 75% of the overall work effort for a penetration test to reconnaissance, as it is this phase that allows the target to be defined, mapped, and explored for the vulnerabilities that will eventually lead to exploitation. ...